diff options
| author | Marcus Meissner <marcus@jet.franken.de> | 2020-11-06 03:47:35 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2020-11-06 03:47:35 +0000 |
| commit | ec9ac7b9c558bc75453e3a9be97aa1644a57ca3e (patch) | |
| tree | 2dc0c8fc86a4d7a276d17b56b752355d1b7f9d2b | |
| parent | 0a3c7995338ae56f875ba5eae8280e30fd790243 (diff) | |
| parent | cd5413890763c5ca414049e51eb5987a4a84bc0b (diff) | |
| download | libexif-android11-qpr3-release.tar.gz | |
fixes some (not all) buffer overreads during decoding pentax makernote entries. am: 836cfdb99e am: 0a45dca22e am: 24bdc1361a am: 8e051e1ef6 am: 3dcd0f5c7e am: 514b69b2a6 am: 2769ec9913 am: cd54138907android-11.0.0_r46android-11.0.0_r43android-11.0.0_r40android-11.0.0_r39android-11.0.0_r38android11-qpr3-s1-releaseandroid11-qpr3-release
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/libexif/+/12970376
Change-Id: I7f065d30b9df7a5d9d6f45b263159d4c08b47778
| -rw-r--r-- | libexif/pentax/mnote-pentax-entry.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/libexif/pentax/mnote-pentax-entry.c b/libexif/pentax/mnote-pentax-entry.c index 7e97c2c..dcb1560 100644 --- a/libexif/pentax/mnote-pentax-entry.c +++ b/libexif/pentax/mnote-pentax-entry.c @@ -425,24 +425,34 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry, case EXIF_FORMAT_SHORT: { const unsigned char *data = entry->data; - size_t k, len = strlen(val); + size_t k, len = strlen(val), sizeleft; + + sizeleft = entry->size; for(k=0; k<entry->components; k++) { + if (sizeleft < 2) + break; vs = exif_get_short (data, entry->order); snprintf (val+len, maxlen-len, "%i ", vs); len = strlen(val); data += 2; + sizeleft -= 2; } } break; case EXIF_FORMAT_LONG: { const unsigned char *data = entry->data; - size_t k, len = strlen(val); + size_t k, len = strlen(val), sizeleft; + + sizeleft = entry->size; for(k=0; k<entry->components; k++) { + if (sizeleft < 4) + break; vl = exif_get_long (data, entry->order); snprintf (val+len, maxlen-len, "%li", (long int) vl); len = strlen(val); data += 4; + sizeleft -= 4; } } break; @@ -455,5 +465,5 @@ mnote_pentax_entry_get_value (MnotePentaxEntry *entry, break; } - return (val); + return val; } |